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A cellular radiotelephone system (10) includes mobile stations (28) which nriay be 
remotely programmed from a customer activation system (12) to effect actix^tion 
and other programming needs. Mobile stations (28) are manufactured in a blank 
form that causes them to operate only in an inactive state. During ac±vation, 
infonnation describing the mobile station's electronic serial number (ESN) is 
collected along with area of use information. A mobile Identification number (MIN) 
is assigned in response to the area of use information. A page message is 
directed to the mobile station operating in its inactive state, but the page 
message references the mobile station's ESN. While inactive, the mobile station 
(28) detects pages directed to its ESN. A remote programming session is then 
perfomied wherein digital user-specific programming data, including the newly 
assigned MIN, are transfen-ed to the mobile station (28) over a voice channel 
using a control channel protocole (80). 
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This invention provide a cellular radiotelephone 
system wtilch Includes mobile stations which may be 
remotely programmed from a customer actispfation system 
to effect activadon and other programming needSL Mobile 
stations are manufactured in e t>lank form that causes 
them to operate only in an inactive state, During 
activation, information describing the mobile station's 
electronic serial number (ESN) is collected along with 
area of use information. A mobile idendtication number 
(MIN) is assigned in response to the area of use 
information. A page message is directed to the mobile 
station operating in its inactive state, but the page 
message references the ESN of the mobile station. 
While iriactive, the mobile station detects pages directed 
to its ESN. A remote programming session is then 
performed wherein digital user-specific programming 
cSaitH. including ttie newly assigned MIN. ere tranGferred to 
the mobile station over a voice channel using a control 
channel protocol A novel cellular telephone which is 
configured for such remote activation, as well as the 
methods of remote activation are also provided. 
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This invention provides a cellutar radiotelephone systsm which includes mobile stations which may be remotely programmed 
from a customer activation system to effect activation and other programming needs. Mobil© stations are manufactured in a 
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ESN A remote SSimlng session Is then perfomied wherein digital user-specWic programming date, '"C<"««"g "^^^ 
Sidned IWIN a^lS^^^ to the mobile station over a voice channel using a control channel protocol. A r^cN^\ cellular 
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ABSTRACT 

This invention provides a cellular radiotelephone system which includes mobile 
stations which may be remotely programmed fifom a customer activation system to effect 
activation and other programminfi needs. Mobile stations are manufactured in a blank form 
that causes them to operate only in an inactive state. During activation, information 
describing the mobile station's electronic serial number (ESN) is collected along with area 
of use information i A mobile identification number (MIN) is assigned in response to the 
area of use information. A page message is directed to the mobile station operating in its 
inactive state, but the page message references the ESN of the mobile station. While 
inactive, the mobile station detects pages directed to its ESN, A remote programming 
session is then performed wherein digitsil user-specific programming data, including the 
newly assigned MIN, are transferred to the mobile station over a voice channel using a 
control channel protocol, A novel cellular telephone which is configured for such remote 
activation, as well as the methods of remote activation are also provided. 
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(a) TITLE OF THE INVENTION 

CELLULAR RADIOTELEPHONE SYSTEM WITH REMOTELY PROGRAMMED 
MOBILE STATIONS 

(b) TECHNICAL FIELD TO WHICH THE INVENTION RELATES 

The present invention relates generally to cellular radio telecommunication systems. 
More specifically, the present invention relates to the control of user-specific programming 
which is stored in, and which is acted upoa» by mobile stations. 

(c) BACKGROUND ART 

Mobile stations which are used in connection with conventional cellular 
telecommunication systems are maimfaccared in a blank or improgrammed state. An 
activation procedure is performed both to acquire customer identification information so 
that customers may be successfully billed for conununication services, and to personalize 
the mobile stations so that they will be capable of providing conununication services. Until 
a mobile station has been activated, it can neither make nor receive a calL After activation, 
changes in either customer preferences or system operating characteristics can require 
changes to the personalization of the mobile stations. 

Personalization is accomphshed by causing the mobile station to include certain user- 
specific programming. The user-specific programming represents data which cause the 
mobile station to function as desired for a specific user. Exan^les of user-specific 
progranuning include, but are not limited to, a mobile identification number (MlN) and 
home system identificadon (SID). The MIN represents the phone number of the mobile 
station, and the home SID represents the identification of the cellular system with which 
the user has contracted to provide communication services. 

Activation is currently accon4>lished through two different techniques. In accordance 
with one activation technique, a skilled service representative collects data from a new 
customer, uses a computer in ^af^ commimication with an on-line computerized customer 
activation system to obtain a valid MIN, and manually operates the keypad of the mobile 
station to program the MIN and other user-specific programming in the mobile station. In 
accordance wifli the second technique, preprogrammed mobile stations are stocked in retail 
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Stores so that no user specific programming need be keyed into the mobile station keypad. 
Both techniques have undesirable consequences. 

The technique of requiring a skilled service representative to program mobUe stations 
forces new customers to go out of thdr way to visit a service representative. This is an 
inoonvemence to customers and limits the availabiUty of mobile stations in mass markets. 
Moreover, this technique is error prone because the human factor is involved m hand-keying 
user-specific programming into mobile -sudons. It is also expensive because of labor costs v^Hich bi« 
associated with making a sufficient number of skilled service representatives available to the 
general public. In addition^ the expense and cnor-prone nature of this technique are 
exacerbated because the programming sequences are typically cryptic, different mobile 
station manufactures use different programmmg sequences, and the programming 
sequences change as new mobile station models become available. 

The second technique of stocking preprogrammed mobile stations addresses some of 
the problems associated with using skilled service representatives to hand-key user-specific 
programming into mobile stations. However, this second technique increases activation 
costs due to the need to inventory and track mobile stations that differ only in their user- 
specific programming. In addition, user-specific programming is typically configured to fit 
general customer profiles rather than the preferences of indivklnal customers. It also leads 
to confusion in the assignment of MINs, For exan^le, MINs are assigned well in advance 
of when the mobile station is actually sold. The MIN is allocated for a particular area or 
location of use, typically at the location of the retain store where the mobile station is sold. 
However, the customer may seldom or never actually use the mobile station near that retail 
store. Consequently, the customer may get a mobile station with a MIN which is" not 
appropriate for the actual area of use of the customer. 

The problems associated with the above two techniques for activating mobile stations 
could^ in large pan, be eliminated through the use of a remotely programmable mobile station. 
While a few remotely progranmiable mobile stations have beeai devised, they cannot be 
remotely programmed fiar activation. Conventional rcmoidy programmable mobile stations 
require the mobile station to be activated beGdrc tbey may be remotely prograznmed. Prior 
activation is required because the mobile stations accomplish remote programming by making 
or receiving a call, but they can Tidthcr make nor receive a caUimtil after acdvati^ In 
adcUtion. conventional remotdy programmable mobile stations use ubiquitous 
tetecommunications modem technology to re^ve the user-specific data. A security risk 
results due to the couplirig of mobile stations to a pubUc network and the widespread 
availability of modem technology in the general population. 
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(d) DESCRIPTION OF THE INVENTION 

Accordingly, it is an object of a first aspect of the present invention to provide an 
improved cellular system having remotely programmed mobile stations. 

An object of a second aspect of the present invention is remotely to programme 
mobile stations for user-specific activation programming and for subsequent alterations in 
the user-specific programming. 

An object of a third aspect of the present invention is to provide remote programming 
without requiring the use of ubiquitous conventional telecommunications modem 
technology. 

An objea of a fourth aspect of the present invention is to provide for the secure 
remote programming of certam mobile stations without requuring significant changes to the 
existing cellular telecommunications infrastructure, 

A first broad aspect of this invention provides an hr^rovOTient m a cellular radio 
telecommunications system which activates mobile stations firom locations remote to the 
mobile stations. The improvement consists of a mobile station comprising a memory having 
a first storage location containing data describing a location-independent identifying code 
for the mobile station, and additional storage locations. The mobile station includes a 
receiver which is configured to receive digital data. The mobile station includes a 
transmitter which is configured to transmit digital data. Finally, the mobile station includes 
a controller which is coupled to the memory, to the receiver, and to the transmitter. The 
controller is configured to evahiate a page message which references the 
location-independent identifying code and to engage in a remote programming session in 
which user-specific programming is received at the mobile station and is stored in the 
additional storage locations* 

By a first variant of this first broad aspect of this invention, the memory is 
configured so that the first storage location resides in a read only con^wnent of the 
memory, and the additional storage locations reside in a read/write component of the 
memory. 

By a second variant of this first broad aspect of this inveniion, and/or a variant of this 
first variant thereof, the location-independent identifying code represents an electronic 
serial number (ESN) that uniquely identifies the mobile s^ion, and the controller is 
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configured to decrypt the signalling data lo determine whether the page message references 
the ESN- By a first variation thereof, the user-specific programming includes a mobile 
ideniificatioa number (MIN), the MIN being a telq>hone number for the mobile station, 
and the controUer is configured to evaluate signaUmg data to d&xect a message which 
references the MIN after performing the remote programming session. 

A second broad aspect of this invention provides a method of operating a cellular 
telecommunications system to manage mobile identification number (MIN) programming 
which is stored in mobile stations, to manage signalling between at least one land station 
and the mobile stations, and co manage die transfer of user information to, and from, the 
mobile stations. The metood includes the steps of establishing a communication between a 
land station and a mobile station using a mode selected from a digital data mode and an 
analog audio mode. The method further mclxides operating the land station in cooperation 
with the mobile station so that the selected digital data mode is used to communicate both 
signalling and the MIN prograroning. The mediod finally includes operating the land 
station m cooperation with the mobile station so that the selected analog audio mode is used 
to communicate the user information. 

By a first variant of this second broad method aspect of this invention, the method 
includes providing the MIN or a tel^hone number which is assigned to the mobile station, 
storing an electronic serial number (ESN) in the mobile station and in order uniquely to 
identify tbe mobile station, operating the mobile station in an inactive state wherein the 
mobile station does not have a valid MIN but has an ESN, operating the mobile station in 
an active state wherein the mobile station has a valid MIN, and signalling pages which are 
directed to the mobile station using data which is selected from data which refierence the 
MIN and data which reference the ESN. By a first variation thereof, the method 
additionally comprises the steps of encrypting the ESN to obtain the signalling data which 
reference the ESN, and decrypting the signalling data which reference the ESN to 
determine whether the signalling data are directed to the mobile station. 

By a second variant of this second broad method aspect of this invention, and/or a 
variants of this first variant thereof, the method includes selecting the MIN to be a 
telephone number which is assigned to the mobile station, storing an electronic serial 
number (ESN) in the mobile station in order uniquely to identify the mobile station, 
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Operating the mobtte station in an inactive state wherein the mobae station does not have a 
valid MIN but has an ESN in an active state wherein the mobile station has a valid MIN, 
operating the land station only in the digital data mode to communicate with the mobile 
station when the mobile station is operating in the inactive state, and operating the land 
station in both the digital data mode and the analog audio mode to communicate with the 
mobUe station when the mobile station is operating in the active slate. 

By a third variant of this second l>road method aspect of this invention, and/or 
variants of the above variants thereof, the method includes selecting the MIN to be a 
telephone number which is assigned to the mobile station, operating the mobile station in 
an inactive state wherein the mobile station does not have a valid MIN. operating die 
mobile station in an active state wherein the mobile station has a valid MIN, and sending, 
TO the mobile station, MIN programming which causes the mobile station to mvalidaie the 
MIN and thereafter to operate in the inactive state. 

By a fourth variant of this second broad method aspect of this invention, and/or 
variants of the above variants thereof, the mediod includes opiating the system to 
communicate a first portion of the signalling in the digital data mode using a control 
channel protocol over control channels, operating the system to communicate a second 
portion of the signalling in the digital data mode using a voice channel protocol over voice 
channels> operating the system to communicate the user information in the analog audio 
mode over the voice channels, and transferring the MIN programming to the mobile station 
using the control channel protocol over one of the voice channels. By a first variation 
thereof, the method additionally comprises the steps of paging the mobile station over one 
of the control channels using the control channel protocol, instructing the mobile station to 
tune to the one voice channel, transmitting a digital synchronizing signal over the one voice 
channel, tuning the mobile station to the one voice channel, synchronizing the mobile 
station to the synchronizing signal, and transmitting the MEM prognunming to the mobile 
station over the one voice channel using the control channel protocol. 

A third broad aspect of this invention provides a method of (grating a cellular 
teleconununications system to manage user-specific programnung which is stored in a 
mobile station having an electronic serial number (ESN) stored therein which uniquely 
identifira the mobile station, the user-specific programming including a mobile 
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identification mirnber (MIN), the MIN being a telephone number which is assigned to the 
mohUe station so that the mobile station operates in an inactive state wherein the mobUe 
station does not have a vaUd MIN but has an ESN and m an active state wherein the mobile 
station has a valid MIN, the method comprising the steps of establishing a conrniunication 
between the land station and the mobile station using a mode selected from a digital data 
mode and an analog audio mode, operating the land station in cooperation with the mobile 
station so that the selected digital data mode is used to communicate both signalling and the 
user-specific programming, operatmg the land station in cooperation with the mobile 
station so that the selected analog audio mode is used to comiminicate the user information, 
\ising the MIN to signal calls directed to the mobile station when the mobile station 
operates in the active state, and using the ESN to signal calls directed to the mobile station 
when die mobile station operates in the inactive stale. 

A fourth broad aspect of this invention provides a method of activating a cellular 
mobile station from a location remote to the mobile station, the method comprising the 
steps of storing, in the mobile station, data describing a location-independent identifying 
code for the mobile station, receiving page signalling messages at the mobile station, 
evaluat'mg the page signalling messages to detect a page which references the 
location-independent identifying code, and engaging, in response to the page, in a remote 
programming session in which user-specific programming is received at and stored in the 
mobile station. 

By a first variant of this foimh broad method aspect of this invention, the method 
includes providing the location-independent identifying code as an electronic serial number 
(ESN). By a first variation thereof, the method includes operatmg the engaging step to 
assign a mobile identification number (MIN) to the mobile station, the MIN being a 
telephone number for the mobile station, operating the mobile station in an inactive state 
prior to activation, operating the mobile station in an active state after activation* and 
paging the mobile station -using data which reference the MIN when the mobile station is 
operating in the active state. 

By a second variant of this fourth broad method aspect of this invention, and/or a 
variant of tlus first variant thereof, the mediod additionally comprises the step of 
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encrypting the ESN, and transmitting a page signaUing message which conveys the ESN in 
an encrypted form. 

By a third variant of this fourth broad method aspect of this invention, and/or 
variants of the above variants thereof, the method includes engaging the mobile station in 
signalling communications, user-specific programming communications, and user 
infbrmation communications, operating in a digital data mode to communicate both the 
signalling communications and the user-specific programming communications, and 
operating in an analog audio mode to comnuinicate the user infbrmation. By a first 
variation thereof, the method includes operating the mobile station to cooperate with a 
cellular system to exchange a first portion of the signalling communications over control 
channels in the digital data mode using a control channel protocol, to exchange a second 
portion of the signaUing communications over a voice channel in the digital data mode 
using a voice channel protocol, and to exchange the user information over the voice 
channels in the analog audio mode, and transferring the user-specific programming to the 
mobile station using the control channel protocol over one of the voice channels. 

By a fourth variant of this fourth broad method aspect of this invention, and/or 
variants of the above variants thereof, the method additionally comprising the steps of 
paging the mobile station over one of the control channels using the control channel 
protocol, instructing the mobile station to tune to the one voice channel, transmitting a 
digital synchronizing signal over the one voice channel, tuning the mobile station to the one 
voice channel, synchronizing the mobile station to the synchronizing signal, and 
transmitting the user-specific programming to the mobile station over the one voice channel 
using the control channel protocol. 

A fifth broad aspect of this invention provides a cellular telephone which is 
cotifigured for remote activation, the cellular telephone comprising an antenna, a 
transmitter which is coupled to the antenna, a receiver which is coupled to die antenna, a 
controller which is coupled to the transmitter and to the receiver, and a memory which is 
coupled to the controller, wherein the controller is configured to detect a page message 
which is received over a cellular network, the page message referencing a 
location-independent identifying code stored in the monory . 
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A sixth broad aspect of this invention provides a cellular telephone which is 
configured for remote activation, the cellular telephone comprising an antenna; 

a transmitter which is coupled to the antenna, a receiver which is coupled to the 
antenna, the receiver being configured to conduct telephone calls, a controller which is 
coupled to the iransmirter and to the receiver, and a memory which is coupled co the 
controUer; wherein the controUer is configured to detect a page message received at the 
receiver and referencing a location-independent identifying code stored in the memory. 

By a first variant of these fifth and sixth broad aspects of this invention, the 
location-independent identifymg code is derived from an electronic serial number (ESN) 
assigned to the cellular telephone. 

By a second variant of these fifth and sixth broad aspects of this invention, and/or a 
variant of this first variant thereof, the controller is further configured to enter a remote 
programming mode after detecting the page message. 

By a first variation thereof, after entering the remote progranmiing mode, the 
controller is configured to accept digital data received by the cellular telephone and to store 
the digital data in the memory. By a second variation thereof, the digital data comprises a 
home system identification number (SID) for the cellular telephone. By a third variation 
thereof, the digital data comprises a system identification number (SID). By a fourth 
variation thereof, the digital data comprises a mobile identification number (MIN) for the 
cellular telephone. By a fifth variation thereof, the digital data comprises an executable 
instruction. 

A seventh broad aspect of this invention provides a cellular telephone comprising an 
antenna, a transmitter which is coupled to the antenna, a receiver which is coupled to the 
antenna, so that the antenna, the transmitter, and the receiver form an air interface for the 
cellular telephone, a controller which is coupled to the air interface, aiid a memory which 
is coupled to the controller, wherein the controller is configured to detect a page message 
received from a cellular network by the air interface, the page message referencing a 
location-independent identifying code stored in the memory. 

An eighth broad aspect of this invention provides a cellular telephone comprising an 
antenna, a transmitter which is configured to conduct telephone calls, the transmitter being 
coupled to the antenna, a receiver which is configured to conduct telephone calls, the 
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receiver being coupled to the antenna and to the antenna, the transmitter and the receiver 
fanning an air interface for the ceUulai telephone, a controUer which is coupled to the air 
interfece, and a memory which Is coupled to the controller, wherein the controller is 
configured to detect a page message recdved through the receiver by the air interface, the 
page message referencing a location-independent identifying code stored in the memory. 

By a first variant of these seventh and eighth broad aspects of this invention, the 
location-independent identifying code is derived from an electronic serial number (ESN) of 
the ceUidar telephone. By a first variation thereof, after detecting the page message, the 
controUer is further configured to receive remote programming information received by the 
air interface. By a second variation thereof, the remote programming information 
comprises a mobUe identification number (MIN). By a third variation thereof the 
conCroUer is configured to store the received mobile identification number (MIN) in the 
memory. 

A ninth broad aspect of this invention provides a celhilar telephone which is 
configured for network initiated activation, die cellular telephone comprising an antenna, a 
transmitter which is coupled to the antenna, a receiver which is coupled to the antenna a 
controUer whidi is coupled to the transmitter and to die receiver, and a memory whidi is 
coupled to the controUer. the memory containing an electronic serial number (ESN) which 
is assigned to the ceUular telephone but not containing a mobUe identification number 
(MIN) which is assigned to die cellular telephone, wherein the controUer is configured to 
detect a page message that references data derived from the electronic serial number CESN) 
and to enter a itatnote programming mode after detectmg the page message. 

By a first variant of tiiis nindi broad aspect of fliis invention, the controUer is 
configured to accept digital data which is received by die cellular telephone whUe the 
controUer is in the remote programming mode. 

A tenth broad aspect of this invention provides a cellular telephone which Is 
configured for network initiated activation, die cellular telephone comprising an antenna, a 
transmitter v^rhich is coupled to die antenna, a receiver which is coupled to His antenna, a 
monoiy containing a location-independent identifying code, and first means for detecting a 
page message which references die location-independent identifying code. 
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By a first variant of this tenth broad aspect of this invention, and/or variants of the 
above variants thereof, the cellular telephone fiirther includes second means for entering a 
remote programming mode after the first means has detected the page message: By a first 
variation thereof, ttie cellular telq)hone is configured to receive digital data while in the 
remote programming mode and to store the digital data in the memory. 

By a second variant of this tenth broad aspect of this invention, and/or a variant of 
this first variant thereof* the digital data comprises a mobile identification number (MIN). 

By a third variant of this tenth broad aspect of this invention, and/or variants of the 
above variants thereof, the digital data comprises a system identification number (SID). 

By a fourth variant of this tenth broad aspect of this invention, and/or variants of the 
above variants thereof, the digital data comprises an executable instruction. 

An eleventh broad aspect of the pr^ent invention provides a cellular telephone which 
is configured for r^note reprogramming, the cellular telephone comprising an antenna, a 
receiver which is coupled to the antenna, a transmitter which is coupled to the antenna, a 
controller which is coupled to the transmitter and to the receiver, and a memory which is 
coupled to the controller, the memory containing an electronic serial number (ESN), and a 
first valid mobile identification number (MIN) for the cellular telephone; and the controller 
is configured to accept digital data wluch is received over a cellular network by the 
receiver operating in a digital data mode and to store the digital data in the memory. 

A twelfth broad aspect of the present invention provides a cellular telephone which is 
configured for network initiated remote programming, the cellular telephone comprising, 
an antenna, a transmitter which is coupled to the antenna, a receiver which is coiipled to 
the antemia, the receiver being configured to conduct telephone calls, a controller which is 
coupled to the transmitter and to the receiver, and a memory which is coupled to the 
controller, and the controller is configured to detect a digital message which is received by 
the receiver and to enter a remote programming mode after detecting the digital message. 

A thirteenth broad aspect of the present invention provides a cellular telephone which 
is configured for network initiated remote programming, the cellular telephone comprising, 
an antenna, a transmitter which is coupled to the antenna, a receiver which is coupled to 
the antenna, a memory containing an electronic serial number (ESN) and a first mobile 
identification ntunber (MIN), first means for detecting a digital message received by the 
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receiver, and second means for entering a remote programming mode wherein the ceUular 
telephone receives digital data which is formatted according to a control channel protocol, 
the second means entering the remote programming mode after the first means detects the 
digital niessage. 

By a first variant of these twelfth and thirteenth broad aspects of this mvention* 
and/or variants of the above variants thereof, tiie receiver is configured to receive the 
digital data formatted according to a control channel protocol. By a first variation thereof, 
the digital data comprises a second mobile identification number (MEN), the second MIN 
being different than the first MIN. By a second variation thereof, the digital data comprises 
a second mobile identification number (MIN). By a third variation thereof, the controller is 
further configured to accept digital programming data received by the receiver while in the 
remote programming mode and to store die digital programming data in the memory. 

By a second variant of these twelfth and thineenth broad aspects of this invention, 
and/or variants of the above variants thereof, the digital data comprises a system 
identification number (SID). 

By a third variant of these twelfth and thirteenth broad aspects of this invention* 
and/or variants of the above variants thereof, the digital programming data comprises a 
mobile identification number (MIN). 

By a fourth variant of these twelfth and thirteenth broad aspects of this invention, 
and/or variants of the above variants thereof, the digital programming data comprises an 
executable instruction. 

By a fifth variant of these twelfth and thirteenth broad aspects of this invention, 
and/or variants of the above variants thereof, the digital data comprises data that 
deactivates the cellular telephone. 

By a sixth variant of these twelfth and thirteenth broad aspects of this invention, 
and/or variants of the above variants thereof* the digital data comprises a deactivation 
command. 

By a seventh variant of these twelfth and thirteenth broad aspects of this invention, 
and/or variants of the above variants thereof, the digkal data is conveyed to the cellular 
telephone through a remote programming session initiated by the cellular network. 
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By a eighth variant of these twelfth and thirteenth broad aspects of this invention, 
and/or variants of the above variants thereof, the digital message is initiated by the 
network. 

A fourteenth broad aspect of this invention provides a cellular telephone which is 
configured for retnote activation, the cellular telephone comprising, an antenna, a 
transmitter which is coupled to ihe antenna, a receiver which is coupled to the antenna, a 
controller which is coupled to the transmitter and to the receiver, and a memory which is 
coupled to the controller, the controller is configured to detect a page message that 
references a location-independent identifying code stored in the memory, and the 
location-independent identifying code is derived from an electronic serial number (ESN) 
which is assigned to the cellular telephone. 

By a first variant of this fourteenth broad aspect of this invention, the controller is 
funfaer configured to enter a remote programming mode after detecting the page message. 

By a first variation thereofp after entering the remote programming mode, the 
controller is configured to accept digital data which is received by the cellular telephone 
and to store the digital data in the memory. By a secotid variation th^eof, the digital data 
comprises a home system identification number (SID) for the cellular telephone. By a third 
variation thereof, the digital data comprises a system identification number (SlD), By a 
fourth variation thereof ^ the digital data comprises a mobile identification number (MIN) 
for the cellular telephone. By a fifth variation thereof, the digital data comprises an 
executable instruction. 

A fifteenth broad aspect of this invention provides a cellular telephone comprising an 
antenna, a transmitter which is coupled to the antenna, a receiver which is coupled to the 
antenna so that the antenna, the transmitter, and the receiver form an air interface for the 
cellular telephone, a controUer whidi is coupled to the air interface, and a memory which 
is coupled to the controller, the controller is configured to detea a page message which is 
received by the air interface, the page message referencing a location-independent 
identifying code which is stored in the memory, and the location-xnd^endem identifying 
code is derived from an electronic serial number (ESN) of the cellular telephone. 
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By a first variant of this fifteenth broad aspect of this invention, after detecting the 
page message, the controller is further configured to receive remote progranuning 
information received by the air interface. 

By a first variation thereof, the remote programmiog information comprises a mobile 
identification number (NUN)- By a second variation thereof, the controller is configured to 
store the received mobile identification number (MIN) in the memory. 

A sixteenth broad aspect of this mvention provides a remotely programmable cellular 
radiotelephone device comprising, a first memory location for storing a unique telephone 
serial number, a second memory location which is programmed with an initial 
identification number wherein the initial identification number is associated with the 
telephone serial number, transceiver means for transmitting and receiving cellular 
radiotelephone communication signals to and from a cellular system, and programming 
means for reprogramming the second memory location in response to receipt of a mobile 
identification number ft^om the transceiver means so that the second memory location is 
programmed with the mobile identification number. 

An eighteenth broad aspect of this invention provides a remotely programmable 
cellular radiotelephone device comprising, a non-programmable memory for storing a 
unique telephone serial number, a programmable memory which is programmed with an 
initial identification number, and the initial identification number comprises digits fi-om the 
telephone serial number, transceiver means for transmitting and receiving cellular 
radiotelephone communication signals to and from a cellular system, and programming 
means for reprogramming the programmable memory in response to receipt of amobile 
identification nimiber from the transceiver means so that the programmable memoiy 
location is programmed with the mobile identification number. 

By a first variant of these seventeenth and eighteenth broad aspects of the unique 
telephone serial number is an electronic serial number (ESN) of the cellular radiotelephone 
service. 

By a second variant of these seventeentii and eighteenth broad aspects of this 
invention, and/or a variant of this first variant thereof, the transceiver means conq>rises 
page receiving means for receiving a data communication message from the cellular 
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system, and the radiotelephone device is identified by the initial identification number and 
the dm communication message compiises the tnobUe identification number, 

A nineteenth broad aspect of this invention provides a wireless telephone which is 
configured for activation through an activation call originated from a location remote to the 
wireless telephone, the wireless telephone compris'mg, an antenna, a transmitter which is 
coupled to the antenna, the transmitter being configured to conduct user information calls, 
a receiver which is coupled to the antenna, the receiver being configured to conduct the 
activation call and the user mformation calls, a controller, which is coupled to the 
transmitter and to the receiver, and a memory which is coupled to the controller, and the 
controller is configured to detect a page message received at the receiver during origination 
of the activation call and refierencing a location-independent identifying code stored in the 
memory. 

A twentieth broad aspect of this invention provides a method for remotely 
programming a cellular radiotelephone device which includes a programmable memory, the 
cellular radiotelephone device being programmed with a unique uiitial identification 
number, the remotely programming method comprising the steps of, providing the unique 
initial identification number to a cellular system, establishing a data conomuntcation session 
from the cellular system to the cellular radiotelephone device using the unique initial 
identification number to idenii^ the cellular radiotelephone device, transmitting data to the 
cellular radiotelephone device during the session, wherein the data comprises a mobile 
identification number; and reprogramming the cellular radiotelephone device so that the 
cellular radiotelephone device is progrannmed with the mobile idemification number. 

By a first variant of this twentieth broad method aspect of this invention, the method 
includes providing the cellular radiotelephone device with a first memory location for 
storing a unique telephone serial nimiber, and associates the initial identification niunbcr 
with the telephone number. 

A twenty-first broad aspect of this invention provides a method for remotely 
programming a cellular radiotelephone device which inchides a programmable memory 
which is progranomed with a unique initial identification number, the remotely 
programming method comprising the steps of, providing the unique initial identification 
number to a cellular system> establishing a data communication session from the cellular 
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system to the cellular radiotelephone device xising the unique initial identification number 
to identify the cellular radiotelephone* transmitting data to the cellular radiotelephone 
device during the session, wherein the data comprises a mobile identification number, and 
reprogramming the programmable memory so that the programmable memory is 
programmed with the mobile identification number. 

By a first variant of this twenty-first broad method aspect of this invention, the 
method includes the step of providing the radiotelephone device with a non-programmable 
memory for storing a unique telephone serial ninnber, wherein the initial identification 
number comprises digits from the telephone mimbet. 

By a second variant of these twentieth and twenty-first broad method aspects of this 
invention, and/or a variant of this first variant thereof, the method includes providing the 
telephone serial number in the form of an electronic serial number of the radiotelephone 
device. 

By a third variant of these twentieth and twenty-first broad method aspects of this 
invention, and/or variants of the above variants thereof, the providing step further 
comprises the step of providing the telephone serial number to the cellular system, and the 
providing step is followed by the step of comparing the telephone serial number and the 
initial identification number. 

By a fourth variant of these twentieth and twenty-first broad method aspects of diis 
invention^ and/or variants of the above variants thereof, the providing step further 
comprises providing data other than the unique initial identification number to the cellular 
system. By a first variation thereof, the providing step is followed by the step of 
controlling the activation of the radiotelephone device, 

(e) DESCRIPTION OF TBE FIGURES 
In die accompanying drawings, 

FIG. 1 shows a telecommimications system which may incorporate one embodiment 
of an aspect of the present invention; 

FIG. 2 shows a block diagram of a mobile station configured in accordance with an 
embodiment of an aspect of the present invention; 
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FIG. 3 shows a flow chart of a process performed by a customer activation system 
(CAS); 

FIG. 4 shows a data format diagram of a three word page response message sent over 
a reverse control channel; 

FIG. 5 shows a data stream protocol diagram of a control channel protocol; 

FIG. 6 shows a flow chart of a method performed by a land station; 

FIG. 7 shows a data format diagram of a two word mobile station control message 
sent over a forward control diannel; 

FIG. 8 shows a flow chart of a method performed by a mobile station; 

HG. 9 shows a data stream protocol diagram of a voice channel protocol; and 

FIG. 10 shows a flow chart of a method performed by the mobile station during a 
remote programming session. 

(f) AT LEAST ONE MODE FOR CARRYING OXJT THE INVENTION 

FIG. 1 shows a block diagram of a telecommunications system 10 which may 
incorporate an embodiment of one aspect of the present invention. Telecommunications 
system 10 includes a customer activation system (CAS) 12 with any number of service 
representative operator stations 14 located nearby. CAS 12 is implemented using a 
conventional computer system. Operator stations 14 couple to a public switched 
telecommunications network (PSTN) 16 or other communications network through a 
conventiona] local loop so that a service repres^tative 
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may engage in telephonic voice conversaiions unth customers and prospective customers. 
CAS 12 couples to a trunk 20 supplied through PSTN 16. Any number of additional 
telecommunications devices 22 may also couple to PSTN 16 to engage in the communicatiott 
of audio, video» data, or other user infonnaiiOA. 

PSTN 16 desirably extends trunk 20 to a mobile telecommuiiications switching office 
(MTSQ) 24. For the most part, MTSO 24 has a conventional structure and performs 
methods which are conventional in the art of cellular telephony, and more particularly in 
accordance whh conventional cellular telephony standards established for the United States of 
America and other countries, as set forth in Standard EIA*5S3 and elsewhere. MTSO 24 
couples to any number of land stations 26, which likewise have generallv conyenttonal 
structures and generally perform coaventionaL methods. However methods performed by 

MTSO 24 and land stations 26 diverge from conventional mediods in the manner set forth 
below< Land stations 26 may represent cell sites, base stations, and the like, which may 
manage radio communications over control channels and/or voice channels so that mobile 
stations 28 may receive telecommunications services. However, land stations 26 arc not 
limited to use only as a cell site but may also be used for a personal or private communications 
system^ In addition, while the "land station** terminology is consistent with the conventional 
cellular telephony lexicon^ land stations are not Umiied to being coupled to land lines and may 
couple to MTSO 24 or other controlling stations through RF links. 

Mobile stations 28 may communicate user information through the voice channels to 
other mobile stations 28, tdeconununications devices 22, or even operator station 14. 
Generally, mobile stations 28 are intended to be used while in motion or during halts at 
unspecified points. However, mobile stations 28 include hand-held units, vehicle-mounted 
uruts, portable units, and units which are phy^cally con6gured for use only at permanent 
stationary locations. 

User information is communicated when a call is setup and a land station 36 and mobile 
station 28 operate in an analog audio mode to communicate analog audio dgnals« 
Consequently, voice communications are directly translated into electronic user tnfonnation> 
and digital data may be translated into electronic user information through the use of modems 
(not shown) which translate di^al data into analog audio signals. 

Likewise, mobile stations 28 may transmit and receive digital signalling data. Signalfing 
data are generally communicated to allocate and otherwise manage the channels over which 
communications are to take place and to indicate a desire to engage in transmittittg user 
infonnatbn over the voice chaxmels. Generally, signalling data are transparent to users. 
Signalling data are communicated when a land Station 26 and mobile station 28 operate in a 
digital data mode to communicate digital data. In the preferred embodiment, digital signalling 
data are communicated using a 10 Kbtt» Manchester encoded, FSK digital communication 
scheme which is well known in the cellular telephony art. 
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In accordance with brgad aspects ofibe present invonion.'yser-speeiiic programming is commawcated 
between CAS 1 2 and mobile statipus 28. User-specific programming geaerally represents 
digital data and/or executable instmctions which personalize or othenvi$e configure a mobile 
station 28 so that It may be used to communicate user information and otherwise provide 
comniunication services in a manner desired by a customer. Examples of typical user-specific 
progranuning include a mobile identification number (MIN), home system identificaUon (SID), 
"A" or "B" system selection criteria, feature package identification, local area dialing rules, and 
the like. In addition, user-specific programming may include programming instructions which 
are executed by a microprocessor within mobile station 28 to cause mobile station 28 to 

faartioniaanypanteularmanito-. Funher. t« ct ,ip^ of 0^ pt^ i„ya»}oa. v^^r^iSc 

programming also includes an instruction which, when executed by a mobUe station 28, 
deactivates the mobile station 28 so that it cannot be used to communicate user inforniiiioa 
User-specific programming is communicated when a land station 26 and mobile station 28 
operate in a digital data mode to communicate digital data using the 10 Kbit communication 
scheme that conventional ceDuiar telephony devices are designed to accommodaie. Thus, no 
ectra modems are required to communicate user-specific pTOgiamming, the expense of the 
extra modems may be eliminated, and the security risk of being vulnerable to unwanted 
programming through ubiquitous modem technology available throughout the world is 
avoided. 

Mobile stations 28 may be remotely programmed even to efifect thdr own activation. 
Desirably. mobUe stations 28 are manufectured. distributed, stocked, and sold in a blank, 
unpersonalized form where they are configured to operate only in an inactive mode. Mobile 
stations 28 may include certain deftult user-spedfic programming which may make mobile 
station 28 usable, although not necessarily as desired by certain customers. 

Bowever. inactive mobile stations 28 do not include a valid MIN. Those skilled in the 
art wiU appreciate thai a MIN represents a teleohone number assigned to a mobile station 28. 
The MIN is desirably assigned based upoi the area of use of the customer for die mobile station 28 
For example, area codes and central office codes need to correspond to the kications wber» 
. the mobne station 28 is most Ckely to be used so that the mobile station 28 will not be roaming 
and otherwise get assessed with excessive fees for the majority of calU and so that incoming 
caUs may be successfiilly routed to the mobile station 28. Thus, a valid MIN is assigned in the 
course of activating a mobile station 28, and this MIN is a location-dependent code consistent 
with an area code and central ofiSce code corresponding to the areas where mobile station 28 
win most likely be used. PSTN 16 uses the MIN in routing calls to particular MTSOs 24. and 
celhilar systems use MlNs to route calU to and torn specific mobDe stations 28. 

While an inactive mobile station 28 does not have a MIN or at least a valid MIN, it 
does have an eleetronie serial number (ESN), The ESN uniquely identifies the mobile station 
28 to anyceOular system and is configured so tiiat it may not be readily changed. The ESN ia 
assigned in . accordance with a code of the iiianufeciuref and another code whibh is uniqtie tb' ft^ \ 
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manufacturer. The ESN does not designate any ansa of use and is therefore a location* 
independent code which conveys no information useful to PSTN 16 in routing calls to the 
mobile station 28 to which it is assigned. 

FIG. 1 shows a sales Idosk 30 which may be used in the aaivation of a mobile station 
28'. Sales Idosk 30 and CAS 12 are typically remotely located from one another, and ixiay in 
some situations be located thousands of miles aw^ from one another. Desirably, sales kiosk 
30 may be located in a retail store where mobile stations 28 are sold to mass markets, and any 
number of sales kiosks 30 may be supported by CAS 12. 

Sales kiosk 30 represents a telKonumtnications device v^iiich couples to PSTN 16 
through a local loop. When a customer wishes to purchase mobile station 28\ the customer 
may physically take mobile station 28' to sales kiosk 30 and use sales kiosk 30 to engage in a 
voice conversation through PSTN 16 with a service representative at a station 14, Through 
this voice conversation, the service representative may collect user activation information fifora 
the customer and enter this information into CAS 12, Such infonnation includes the 
identifying data which permits a cellular service provider to successfijlly bill for communication 
services. It also includes the ESN for mobUe station 22\ vAdch a customer may» for example, 
recite from reading a tag affixed to mobile station 28'. In addition, the activation information 
includes location data which inform the service representative where mobile station 28' is most 
likely to be used. This information may be inferred from die address of the customer and die 
address of sales kiosk 30, and/or directly obtained from a conversation with the customer. 
Through the voice conversation, the customer may select preferred feature packages and the 
like. 

When the activation information has been gathered, and preferably while the voice 
conversation is ongoing, CAS 12 automatically causes an ^activation call" to be placed to 
mobile station 28*. The appropriate MTSO 24 to use for this call is selected by CAS 12 in 
re^onic* to an address of the sales kiosk 30 where mobile station 28' is currently tocated. 
Methods which arc discussed bdow are performed in CAS 1 2. MTSO 24, land stadons 26, 
and mobile station 28' so that mobile station 28' will recognize and respond to the call by uang 
a paging message which references the mobile station^s ESN. Once a data Unk is established, a 
remote programming session is performed where user-specific programming, including a newly 
assigned MIN. is transferred to mobile station 28' and stored therein. At the conclusion of the 
remote prognumitiing session, mobile station 28' may be used to communicate user informatioiL 

FIG. 2 shows a block diagram of electronic hardware included in a mobile station 28 
which IS configured in accordance with the requiremeiits of system 10. An antenna 32 of 
mobile station 28 couples to a fir^t port of a duplexer 34. while a second port of duplcxer 34 is 
adapted to retxive a modulated RF signal provided by a transmitter 36 and a third port of 
duplexer 34 provides a received RF signal to an input of a receiver 38. An audio output from 
receiver 38 couples to a speaker 40, and an audio input to transmitter 36 couples to a 
microphone 42. Transmitter 36 recdv^ analog auifio signals from microphone 42 and 
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receiver 38 provides analog audio signals to speaker 40 when mobile station 28 operates in its 
analog audio mode. Although not shown, a modem may couple to or otherwise be switched 
into these analog audio paths so that digital data convened into ail analog audio fbnn may be 
cotniijunicated in a conventional manner while mobile station 28 operates in its analog audio 
mode. 

A cootroUer 44 controls the operation of mobile station 28. ContioUer 44 may be 
implemented using one or more commercially available microprocessors. Controller 44 
provides controlling agnals to transmitter 36 and to receiver 38 over data lines 46 and 48, 
respectively. In addition, controller 44 provides digital data to a digital data input 50 of 
transmitter 36 for transmission while mobile station 28 operates in its digital data mode and 
receives digital data ftom a digital data output 52 of recover 38 while mobile station 28 
operates in its digital data mode. In the preferred embodiment, the controlling signals applied 
over data lines 46 and 48 identify frequency channels to which transmitter 36 and receiver 38 
are instructed to tune, and they specify whedier transmitter and receiver 36 and 38. 
respectivdy. are to operate in the analog audio mode or distal data mode. 

A displ^ 54 couples to controller 44 and visually shows information provided thoeto 
by comroUer 44. A keypad 56 couples to controller 44 so that controller 44 may detect key 
presses and then appropriately respond to the key presses. A timer 58 couples to controUcr 44 
and helps controller 44 monitor the passage of time. In addition, a raeraoiy 60 couples to 
controller 44. Memoiy 60 stores data, variables, tables, lists, and databases that are used in 
connection with the operation of mobile station 28. In addition, memoiy 60 stotes 
programming instnictions which are executed by controller 44 and define the various 
"Kfliods procedures, routines, tasks, and the like perfetmed by controller 44 and mobile 
station 28. In the preferred embodlnicnts. memory 60 is pwtitioaed into three components. A 
random access memory (RAM) component 62 represents volatile read/write memoiy. An 
electrically erasable programmable read only memory (EEPROM) component 64 provides " 
non-volatile read/write memoiy, and a read only memoiy (ROM) component 66 represents 
non-volatile, read only memory which cannot be easOy erased or otherwise altered. Those 
skilled in the art win appreciate that ROM component 66 may be implemented using PROMS 
EPROMS. and the like. 

Desirably, default user-spedfic programming is stored both In ROM 66 ahd EEPROM 
64 when mobile station 28 is manufactured and sold to a customer. This default user-spedfic 
programming includes an invalid MIN and an invkUd home SID, along with a fectoiy setting 
for a keypad lock code and an index to a predetennined default features package. Due at least 
in part to the use of an invafid MIN. mobile station 28 cannot engage in calls which 
comn»micate user infemiation at this point. ROM 66 also stores the locationnndependent 
ESN for mobile station 28 and data identifying aU control channels used by "A" and "B" 
cellular systems. 
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FIG. 3 shows a flow chart of a mfithod 68 performed by customer activation systetn 
(CAS) 12.CAS method is perfonned when user-specific prograirnning needs to be 

remotdy programmed into one or more mobUe stations 28, such as may occur during 
activation. While HG 3 specifically illustrates program flow for an activatioti, a similar 
method may be followed for other remote programming sessions which may occur after 
activation. As indicated by ellipsis in FIG. 3, method 68 may perform many tasks which are 
not directly related to writing user-specific progranmiing to mobile stations 28. Such tasks 
may incbide the capture and maintenance of customer identification and billing records. 

Method 68 performs a task 70 to collect customer activation data. TKs activation data 
desirably include information describing the area where the mobile station 28.win most often 
be used, where the mobile station 28 is currently located, the ESN of the mobile station, and other 
data. Task 70 may be performed with the cooperation of a service representative who is 
engaging in a voice telephone conversation with a customer who may be located at a sales 
kiosk 30 (see HG. 1), 

After task 70, a task 72 assigns a valid MIN to the mobile station 28 in response to the 
area of use identified above in task 70. This area of use may, but need not, include the location 
of sales kiosk 30. The assigned MIN represents a 1 0 digit phone number that is not currently 
in use elsewhere, and has an area code and office code consistent with the MTS0.24 fsee FIG. 
1) foi this area of use. Next, a task 74 encrypts the ESN of the mobile stadon into an invalid MIN 
fbnnat 

FIG. 4 shows a data format diagram of a three word page response m^sage 76 sent by 
a mobile station 28 over a reverse control channel to a land station 26. Message 76 foUou^ 
conventional cellular telephony standards. As FIG. 4 illustrates, the MIN is formatted as a 34- 
bit binary number having a fim ponion (MINI) conveyed by a first word and a second portion 

CMIN2) conveyed by a second-word* The-ESN is a 32-bit binary number-that is conveyed in a 

thiid word. 

Referring back to FIG. 3, task 74 applies the 32-bit ESN of the mobile station to an 
encryption algorithm which generates a 344iit encrypted ESN-MIN, and the 34-bit ESN-MIN 
is formatted as thougih it were an invalid MIN. The use of an invalid MIN format guaranteea 
that no activated mobile station 28 will accidentally, recognize the encrypted ESN as its MIN, 
An invalid MIN may be obtained by, for example, forcing the first digpt of the decimal form of 
the ESN'MIN to a vahie of zero. The particular encryption algorithm implemented at task 74 

is Bta. lelevad to various aspects of the prcseni iavcntion. aod this aL^DnUun may use copn/emlonai public or 1 
private key encrypting techniques. As discussed below in more detail, the ESN-MIN will be 
used in lieu of a MIN to page the mobile station 28. The use of encryption further enhance 
security by reducing the risk of third party meddling with mobile station programming. 

After task 74. a task 78 forms an activation record containing all the user-spcdfic 
programming to be written into the mobile station 28 ia an upcoming remote progrBmming 
$c$sicxi. Desirably, the activation record is made up of one or more words» where each word 
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mchjdes a parameter identity (PID) and paramctctf value (PVAL). The MIN assigned above in 
task 72 to mobile station 2S represents one of the parameters conveyed in a word^ and the 
activation record may include any number of words. Various PID/PVAL words maty also be 
coded to present instructions to mobile station 28 rather than raw parameter data. Such 
instructions mey. for example, instruct mobile station 28 that the previous PID/PVAL word 
was the last word to be transferred in the remote prograrruning session. In another example, a 
PID/PVAL word may be coded as a command to deactivate mobile station 2& and ther^y 
undo the user-specific programming specified in a previous activation. 

In addition, task 78 arranges the PID/PVAL words in accordance with a mobile station 
control message delivered using a control channel protocol 80. FIG. 5 shows a data stream 
protocol diagram of control channel protocol SO for a message that conveys one word of data. 
Protocol 80 is a conventional user-inaccessible protocol used in cellular telephony for control 
channel digital data communication. It conveys one 40-bit word for each 463-bit message. As 
illustrated in FIG. S, protocol 80 includes a 10-bit dotting sequence plus a busy/idle bit, 
followed by an 1 1-bit word sync pattern plus a busy/idle bit^ followed by five.interieaved 
repetitions of an "A** stream 40-bit word and a '*B'' stream 40-bit word, wherein a busy^dle bit 
is inserted for each 10 bits of the A and B stream words. Conventionally, the "A" stream is 
distinguished firom the "B** stream by the least significant bit (LSB) of the MIN to which the 
streams are directed. Thus, task 78 may repeat the PID/PVAL words in the "A" or T3" stream 
per protocol 80 and the LSB of the ESN-MIN generated in task 74 (see FIG, . 3), or task 7S 
may simply repeat each PID/PVAL word ten times in each message. Control channel protocol 
80 is executed on an assigned voice channel so that user-specific prognuifming may be quickly 
, transferred using as few system resources as possible. The entire method of remotely 
activating a mobile station 28 should take only a few seconds once the customer activation 

informatioQ.has been collected. - • 

After task 78, a task S2 selects an appropriate MTSO 24 (see FIG. l)Lba5ed upon the 
current location of the mobile station 28 to be remotely programmed^ establishes 4<lata link to 
this MTSO 24. and instruas the MTSO and cellular system it conttP^.to ^a^jMhe ESNrMIN 
number generated above in task 74. From the perspective of the cellular system, the ESN-MIN is ^ 

treated as a valid MIN, and a conventional paging process is performed. CAS .method <$8 
performs a task 84 to determine whether the page is eventually successfiil. If not successfiil, 
program control passes to an error handling routine 86 so that an appropriate action may be 
taken. For the above described activation , method a customer is engaged in an ongoing 
conversation with, a service representative, and the error routine 86 may simply inform the 
service representative of the problwn. For other remote programming situations, the 
unsuccessfid page may simply be logged for queuing again at a later time. 

When the page is successful, a task 88 sends the next user-specifid programming 
message from the activation record formed above in task 78 through trunk 20, PSTN 16, 
MTSO 24, and a land station 26 (see FIG. 1) to mobile station 28. After task 88, a query task 



PAGE 33/65 ' RCVD AT 10/7/2005 7:20:07 PM [Eastern Daylight fimel * SVR:USPTO-EFXRF-6/24 ' DN1S:2738300 ' CSID:M3 228 9446 ' DURATION (infn^):16-00 



10/07/05 16:32 FAX 503 226 9446 



KLARQUIST PATENT 



121034 



23 

90 waits for ciiher an acknowledgment (ACK) or no acknowledgment (NAK) response from 
mobile station 28. Based on the nature of the received response, if any, task 90 dctcnmnes 
whether the prior message was successful. If it was not successful, a tadc 92 adjusts a pointer 
to the activation record formed in task 78 to repeat the last record, and program control loops 
back to task 88. Although not shown, this loop may include additional tasks to break the loop 
should an excessive number of unsuccessful attempts be made. 

When task 90 determines that the last message was successfully delivered, a query task 
94 determines whether the final message from the activation record has been denvercd. So 
long as additional messages remain, program control loops back to task 88 to continue sending 
PID/PVAL word messages to mobile station 28. When finished, program control exits method 
68 and mobile station 28 has been remotely acuvated. 

.Methods 68 also may be used to remotely program mobile stations 28 which are 
currently activated. For post-activation remote programming, task 70 may gather the user- 
specific programming to be downloaded into the mobile station 28. Tasks 72 and 74 may 
substitute the cTCisting MIN of the mobile station for the encrypted ESN-MIN discussed above 
After task 74 program flow prpcccds as described above, and the mobile station 28 will be 
paged using its NGN. .Method 68 may also be repetitively performed remotely to program 
entire populations of mobile stations 28. This situation may occur when a cellular system 
change takes place, e.g.p assigning new area codes or central office codes to a cellular 
system. In this sinjation, an entire population of mobile stations 28 requires update user* 
specific programming reflecting newly as^gned MINs. Method 68 may be repeated fbr each 
mobile station 28. .Task 70 obtains a new MIN, tasks 72 and 74 identify an old MIN. and 
program flow proceeds as described above, but is repeated for each mobile station 28 in the 
population. 

FIG. 6 shows a flow chart of a method. 96 performed by a land station 26. While 
method 96 is direaed toward a single land station 26. those skilled in the art will appreciate 
that portions of it may be performed by the MTSO 24 which controls it and Vy other land 
stations 26 which are also controlled by that MTSO 24, As indicated by ellipsis in FIG. 6» 
method 96 includes many tasks related to manag^g channels that are allocated to land station 
26 and are conventional in cellular tdephcxiy. A query task 98 is performed to signal when the 
land station 26 receives a page instruction from CAS 12 (see FIGs. 1 and 3). So long as no 
such instruction is received, land Station 26 continues to perform conventional cellular land 
station processes. 

Desirably, when the page instruction is received, all land stations in the cdlular system 
controlled by MTSO 24 sinnuttaneously receive the same instruction. At this point, a task 100 
pages the 'T^flN" specified in the instruction with a local control order "tune and sync* 
message. As discussed above, it may be either a valid MIN or the ESN-MIN number 
discussed above in connection with task 74 (see FIG. 3). Land station 26 uses a conventional 
mobile station control message, e.g., message 102 shown in FIG. 7» and delivers mesrage 
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102 while operating in its digital mode over a control channel using control channel protocol 
80(5cenG-5). 

Referring briefly to FIGs, 6 and 7, task 100 configures mobile station control message 
102 as a local control order page message by inserting the MIN, wWch may be the ESN-MIN 
during an activation, in MINI and MIN2 fields of fim and second words, by setting an 
appropriate value ( 1 111 0) in the order field, and by setting die local field to a code that mobile 
station 28 will interpret as a tune and sync command 

Referring back to FIG. 6. after task 100 pages the MIN or ESN-MIN obtained fi-om 
CAS 12, a query task 104 detemunes whether a page response message 76 (see FIG. 4) was 
leccived fi^om the mobile sution 28. As shown in ¥IG. 4, the page response message mdudcs 
the MIN or ESN-MIN so that land station 26 can verify that it responded to the previous local 
control order page message. If no page response message is received, program control loops 
back to task 100. Although not shown, additional tasks may be included to break tins loop 
after a certain number of repeated paging attempts have been tried or if an instruction to do so 
is rec^ved via MTSO 24. 

When task 1 04 detects a page response message 76 (see FIG. 4) that responds to the 
tune and sync local control order page message transmitted above at task 100, a task 106 finds 
an idle voice channel, marks the channel busy so that it will not get assigned to other niobile 
stations 28, and transmits a digital syndironizing signal over the selected voice chainnel. 
Moreover, task 106 transmits the synchroni^g signal on the voice chaimel using control 
diannel protocol 80 (see FIG. 5). Task 106 may. for example, continuously transmit hs 
overhead message over this voice channel. While task 106 causes land station 26 to operate 
one of its voice channels somewhat like a control channel, nothing requires any alteration in the 
manner In which land station 26^perates its control channd. In other wonls. control chatuiel 
overhead and control channd messages continue to be transmitted ^m land station 26 over Its 
control channel. 

After task 106, a task 108 transmits a voice channel assignment message over its 
control channel using the conventional channel assignment protocoL Next, a query task 1 10 
causes land station 26 to monitor the voice chamtet assigned above in task 106 for a ready 
message transmitted by mobile station 28. The ready message is sent to land station 26 using a 
reverse control channel protocol even though this is a voice channeL Program control stays at 
task 110 until this ready message is received. However, error handling tasks (not shown) may 
be included to address the situation where the mobile station 28 &ils to respond with the ready 
message. 

When task 1 10 detects the ready message, a task 1 12 is performed to patch the voice 
channel to trunk 20 (see FIG. 1) and to inform CAS 12 (see FIG. 1) that the page was 
successful At this point* CAS 12 controls the data link to mobile station 28. Land station 26 
exerts no further infhi^ce ov^ the remote programming session. Rath^, CAS 12 controls the 
remote programming session as discussed above In connection with FIG. 3, Land statioA 26 
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merely performs a query task U4 to determine when tnink 20 goes inactive. When trunk 20 is 
dropped, land staiion 26 performs a task 1 16 to tear down the call to mobile station Z8, As a 
result of tearing down the call, the voice channel becomes idle again and may be used as 
needed to convey user information to and frorn mobile stations 28. 

FIG. 8 shows a flow chart of a method ii8 performed by a mobile station 28. Method 
1 18 may be pecformcd when mobile station 28 powers up. Mobile station 28 performs various 
initiafizaiion tasks, bduding a task 120 which causes it to operate in its distal data mode. As 
discussed above in connection with FIG. 2, in this mode digital data, rather than analog audio 
signals, are routed through transmitter 36 and receiver 38. After task 120, a query task 122 
determines whether mobile station 28 is acrive. Task 122 may, for cxampte, determine 
whether its user-specific programming includes a valid MIN^ but other evaluations can lead to 
the same conclusion. If mobile station 28 has not been activated, then it will operate in its 
inactive state, and program control proceeds to a task 124, 

Task 124 scans control channels, the identities of which are programmed into tiK^bile 
station 28, to select a best server control channel. Task 124 may monitor a received signal 
strength indicator (RSSI) when tuned to a control channel to determine whether any recdved 
signal exhibits sufficient strength. 

After task 124, a task 126 performs a decryption operation which complentents the 
encryption operation discussed above in connection with task 74 (see FIG. 2Y ThcidecrypiiDa 
operation may be perfoimed in ai least two different ways. The ESN of the mobile station may be 
encrypted in a manner similar to that discussed above m connection with task 74 so that a 
resulting encrypted ESN-lvON is generated by task 126. Tius ESN-MIN m^ be compared 
with MINs conveyed &om land stations 26 in page messages. Ahemately, MiNs may be 
parsed &om received page messages and subjected to algorithms which complement the 
encryption algorithm performed by CAS 12 in task 74. This '"decrypted" IwDN may then be 
compared to the mobile station's ESN. 

After task 126, a query task 128 determines whether a tune and sync-lncal control 
order page message received from the control channel references the ESN of the mobile station 
Mobile station 28 may continue to monitor paging messages received over the selected control 
channel for a few seconds before task 128 decides that no page directed to its ESN has been 
received. When task 128 makes this determination, program control loops back to task 124 to 
select a different control channel and repeat the process of monitoring for a page message 
directed to the mobile station's ESN. In the preferred embodiment, the control channels 
selected at task 124 alternate between A and B celhilar sy^ems^ and task 124 may select not 
only the control channels in each system with the strongest signals, but the control channds 
with the nect strongest agnals. 

As discussed above, page messages directed to the mobile station may be 
simultaneously tr^nsn^tted firom all land stations 26 within a particular cellular system. Thus, a 
good chance exists that a page will be detected within a few tries. When task 128 detects an 
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ESN referenctd tune and sync local control order page message, a task 1 30 returns the 
appropriate page response message 76 (see FIG. 4) over the reverse control chajmel. The 
page response message echoes the ESN-MIN for the mobile station's MIN in the response 
message:, and may include the mobile station's ESN. 

After task 130^ a query task 132 causes mobile station 28 to wait until the voice 
channel assignment message is received over the control channel. However, additional tasks 
may cause program control to exit task 132 if a voice channel assignment message is not 
forthcoming. In addition, additional tasks may evaluate received messages to determine if 
some other message or command directed to mobile station 28 is received. Whmthe voice 
channel assignment message is detected, a task 134 is performed to tune transmitter 36 and 
receiver 3S (see FIG. 2) to the specified voice channel. Afier tesk 134. a query task 136 
monitors the digital data signals and messages received over the voice channel until 
synchronization has been achieved. When mobile station 28 is synchronized to the (Ug^tal data 
being transmitted over the voice channel, a task 138 returns the ready message to the land 
station 26 over the voice chaimel using a reverse a>ntrol channel protocol which is normally 
used only on control channels. 

After task 138, program control proceeds to a remote programming sesaon 140, which 
is discussed in more detail below. During remote programming session 140 mobile station 28 
continues to operate in its digital mode and its inactive state. Through remote programming 
session 140, user-^spedfic programming mil be communioited to mobile station 28 over the 
voice channel using control channel protocol 80 (see FIG. S). Upon successfiil completion of a 
remote programming session 140. mobile station 28 may be activated and will thereafter 
operate in its active state. In its active state, mobile station 28 may operate in either its anak>g 
audio mode or its digital data mode. 

Kefening back to task 122, when mobile station 28 deddes that it is active, h operates 
in its aaive state to perform numerous taafcs« as indicated by ellipsis, which are conventional 
for ceDular molnle sutions. These tasks include monitoring control dtannels to detect 
incoming calls, tracking changes in chaimel availability, and momtoring keypad 56 (see FIG. 2) 
for user input A query task 142 represents one such conventional mobile station task. Task 
142 determines whether a MIN referenced page has been received at mobile station 28. In 
other words, task 142 determines whether a page message received at mobile station 28 
conveys the MIN assigned to mobile Station 28 through activation. 

When task 142 detects a MIN referenced page, a query task 143 determines whether 
the page IS a tune and sync local control order page message. The local control order i^e 
message differs from a page order in that the page order informs mobile station 28 of an 
incoming call and the tune and sync local control order page message informs mobile stadon 
28 of an upcoming remote programming sessioit If task 143 detects a tune and sync local 
control order page message, program control proceeds to task 130 to return the page response 
message and proceed with tuning and synchroni2ing to a voice channel as discussed above. 
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If task 1 42 determines that the page message was not a tune and sync local control 
order page message, then a query task 144 detennines whether an incoming user infbmiation 
call is indicated through a page order message. If a user information call is not indicated, then 
program control proceeds to task 132 fiirther to process the page message to detenninc what 
sort of communication has been received. If a user information call is indicated, then mobile 
station 28 returns a page response message (not shown) and otherwise handles the call in a 
conventional manner. 

In particular, a task 146 causes mobile station 28 to operate in its analog audio mode, 
and a query task 148 causes mobile station 28 to remain in its analog audio mode until the call 
terminates. When the call terminates, mobile station 28 reverts back to its digital data mode of 
opei^ion, as indicated in a task ISO, and program control loops back to the task 142. 

Mobile station 28 switches to its analog audio mode when it receive an instruction to 
switch to a voice channel* When operatit\g in the analog audio mode> both digital data and 
analog audio communications may take place. The analog audio communicatrons convey the 
user information and account for the vast majority of communicatitms which may take place. 
However, a small amount of signalling may also take place using distal data communications. 
Such signalling includes the communication of hand off messages. Digital data 
communications which occur over the voice channel follow a voice channel protocol 152, as 
shown in FIQ. 9. Voice channel protocol 1S2 differs ^gnificantty from control channel 
protocol 80 (see FIG. 5). Since a continuous stream of data are not provided over the voice 
channel, mobile station 28 does not have the opportunity to become well synchronized. Thus, 
voice channel protocol 152 includes a 101-btt dotting pattern followed by eleven repeats of a 
single 40-bil word interleaved with 37-bit dotting sequences and 1 1-bit word sync patterns. 
Voice channel protocol 152 conveys one 40-bit word using 1069 bils. Thus, distal data 
communication using voice channel protocol 152 has a greatly reduced data throughput 
compared to control charmel protocol 80. On the other hand, only a voy small amount of 
digital data are conveyed using protocol 152. 

Accordingly, when mobile nation 28 operates in its acdve state, it communicates using 
both the analog audio mode and the digital data mode. A very small amount of digital 
signalOng data may be communicated in the analog audio mode, but data throughput suffers 
due the use of voice channel protocol 1S2 which acxommodates an inability to achieve 
thorough synchronizattoa While FIG. 8 illustrates the detection of only MIN referenced pages 
wh«i mobile station 28 operates in its active state^ those skilled in the art will appreciate that 
nothing prevents additional tasks from being inserted which might also detect ESN referenced 
pages along the lines of tasks 126 and 128. 

FIG. 10 shows a flow chart of remote programming session 140 performed by mobile 
station 28* Generally* remote programming ^ssk>n 140 responds to and complements the 
method performed by CAS 12 and discussed above in connection with FIG. 3. Substantially 
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the same method, is pcrfonned whether mobile station 28 receives a MIN referenced page or an 

ESN referenced page. 

Remote programming session 140 performs a task 153 to receive a message which 
conveys a PID/PVAL word from CAS 12. The PID/PVAL word is received over a voice 
channel using conirol channel protocol 80 (see FIG. 5). As discussed above, the PID/PVAL 
word is repeated several times in the received message, and task 1 53 may vote on the most 
likely data configuration, verify parity, and perform other verifications which evaluate whether 
the parameter value (PVAL) is compatible with the specified parameter ID (PID). The 
received PID/PVAL word is stored in a temporary buffer in memory 60 by a task 154, and a 
task 156 then returns cither an acknowledgment (ACK) or no acknowledgment (NAK) 
message to tell CAS 12 whether to repeat the message or go on to Ihe next message. 

After task 156, a query task 158 determines whether the last received user-specific 
programming message conveyed an end session command. So long as this command has not 
been received, program control loops back to task 153. However, additional tasks (not 
shown) may be included to break the loop should no messages be received for an excessive 
duration. 

AVhen task 158 detects the end session command, a query task 160 determines whether 
the PED/PVAL words received mclude a deactivation command. If no deactivation command 
has been received, a task 162 saves the temporaiily stored parameter values (PVALs) to the 
appropriate locations in non^volatile read/write component 64 of memory 60 (see FIG. 2). As 
dismissed above, dtiring activation remote programming sessions, a valid MIN and other 
parameters are down loaded to mobile station 28 through the remote programming session. 
Thus, task 1 62 causes the valid MIN and other parameters to be saved in memory 60. After 
task 162, program control exits remote programming session 140, and may proceed back to 
mobile station process 1 18 (see FIG. 8), where mobile station 28 will then operate in its active 
state. 

When task 160 detects a deactrvation command, a task 164 retrieves dc&ult user- 
specific programming firom read only component 66 of memory 60. This default user-specific 
programming includes an invalid MIN, a default keypad lock code, and other default vahies. It 
has the effect of preventing mobile station 28 fi^om communicating user information and 
forcing mobile station 28 to operate in its inactive state. AAer task 164, a task 166 saves this 
irtactive user-specific progranmiing in non- volatile read/write component 64 of memory 60, 
thereby overwriting any active user-specific programming which may have been previously 
stored there. After task 166, program control exits remote programming session 140 and msy 
proceed back to mobile station process 1 18 (see FIG. 8). where mobile station 28 will then 
operate in its inactive state. 

The inchi^on of an inactive command, when coupled witfi the security precautioos 
provided »ipects of tbc" present invention, is advantageous for organizadons- wWch rent or loan mobile 
stations 28. The deactivation coxmnand helps such organizations maintain tight control over 
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iheiT mobile stations 28 rendering (be mobile stations 28 unusable when users are not 
complying with rental or loan arrangcraents. 

While the remote piogranmiing session 140 discussed herein is configured to 
illustrate the writing of user-specific programming to mobile stations 28. nothing prevents 
remote programming session 140 from additionally being configured to read or audit data 
stored in mobile stations 28. 

In summary, the present invention In its various aspects provides an improved 
cellular system having remotely programmable mobile stations. The mobile stations may be 
remotely programmed for user-specific activation programming and for subsequent 
alterations in the user-specific programming. The present invention in its various aspects 
provides remote pragramraing without requiring the use of ubiquitous conventional 
telecommunications modem technology and without sufi=ering the security risks associated 
therewitii. In addition, the secure remote programming of certain mobile stations is 
achieved without significant changes to the existing cellular telecommunications 
infrastructure. Consequenfly, it may be successfully implemaited at minimal expense. 

The present invention has been described above with reference to preferred 
embodiments. However, those sicilled in the art will recognize that changes and 
modifications may be made in these preferred embodiments without departing fit>m the 
scope of various aspects of the present invention. For example, while aspects of the present 
invention have been described herein in connection with a particular cellular system, the 
present invention in other aspects may also be used in connection with a wide variety of 
cellular systems and other radio telecommunication systems- Furthermore, while aspects of 
the present invention has been descried in connection with a specific progra mmi n g flow, 
those skilled in the art will appreciate that a large amount of variation in configuring 
process tasks and in sequencing process tasks may be directed to accomplishing 
substantially the same functions as are described herein. 
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CLAIMS 

1 . In a cellular radio telecoimnunications system which activates mobile stations from, 
locations remote to said mobile stations, a mobile station comprising; 

a memory tiaving a first storage location containing data describing a 
location-independent identifying code for said mobile station, and additional storage 
locations; 

a receiver which is configured to receive digital data; 
a transmitter which is configured to transmit digital data; and 
a controller which is coupled to said memory, to said receiver, and to said 
transmitter, said controller being configured to evaluate a page message which references 
said location-independent identifying code and to engage in a remote programming session 
in which user-specific programming is received at said mobile station and is stored ui said 
additional storage locations. 

2. The mobile station as claimed in claim 1, wherein said memory is configured so that 
said first storage location resides in a read only component of said memory and so that said 
additional storage locations reside in a read/write component of said memory. 

3. A mobile station as claimed in daim 1 or claim 2 wherein; 

said location-independent identifying code represents an electronic serial number 
(ESN) that uniquely identifies said mobile station; and 

said controller is configured to decrypt said signalling data to determine whether said 
page message references said ESN. 

4. A mobile station as claimed in claim 3, wherein: 

said user-specific programming includes a mobile identification number (MIN), said 
MIN being a telephone nuniber for said mobile station; and 

said controller is configured to evaluate signalling data to detect a message whidi 
references said MIN after performing said remote programming session. . 
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5, A method of operating a cellular teleconununications system to manage mobile 
identification number (MIN) programming stored in mobile stations, to manage signalling 
betwem one or more land stations and said mobile stations, and to manage the transfer of 
user iidbnnadon to and from said mobile stations, said method comprising the steps of: 

communicating between a land station and a mobile station using a mode selected 
from a digital data mode and an analog audio mode;* 

operating said land station in cooperation with said mobile station so that said 
selected digital data mode is used to communicate both signalling and said MIN 

prngr ammmg ; and 

operating said land station in cooperation with said mobile station so that said 
selected analog audio mode is used to communicate said user infbrmation. 

6. A method as claimed in claim 5, including: 

providing said MIN as a telephone number which is assigned to said mobile station; 

storing an electronic serial number <ESN) in said mobile station in order uniquely to 
identify said mobile station; 

operating said mobile station in an inactive state wherein said mobile station does not 
have a valid MIN but has an ESN, and operating said mobile station in an active state 
wherein said mobile station has a valid MIN; and 

signalling pages which are directed to said mobile station using data which is selected 
from data which reference said MIN and data which reference said ESN. 

7. A method as claimed in claim 6« additionally comprising the steps of: 
encryptmg said ESN to obtain said signalling data which reference said ESN; and 
decrypting said signalling data which reference said ESN to determine whether said 

signalling data are directed to said mobile station. 

8. A method as clauned in any one of daims 5 to 7, which includes: ' 

providing said MIN as a telephone number which is assigned to said mobile station; 
storing an electronic serial number (ESN) in said mobile station and in order uniquely 
to identify said mobile station; 
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operating said mobile station in an inactive state wherein said mobile station does not 
have a valid MIN but has an ESN, and operating said mobile station in an active state 
wherein said mobile station has a valid MIN; 

operating said land station only in said digital data mode to communicate with said 
mobile station when said mobile station is operating in said inactive state; and 

operating said land station in both ^id digital data mode and in said analog audio 
mode to communicate with said mobile station when said mobile station is operating in said 
active state. 

9. A method as claimed in any one of claims S to 7 which includes: 

providing said MIN as a telephone number which is assigned to said mobile station; 

operating said mobile station in an inactive state wherein said mobile station does not 
have a valid MDNf, and operating said mobile station in an active state wherein said mobile 
station has a valid MIN; and 

sending, to said mobile station. MIN progranmung which causes said mobile station 
to invalidate said MIN and thereafter to operate in said inactive state. 

10. A method as clahned in any one of claims 5 to 9> which include: 

operating said system to communicate a first portion of said signalling in said digital 
data mode using a control channel protocol over control channels, to communicate a second 
portion of said signalling in said digital data mode using a voice channel protocol over 
voice channels, and to communicate said user information in said analog audio mode over 
said voice channels; and 

transferring said MIN programming to ssdd mobile station using said control channel 
protocol over one of said voice channels. 

11. A method as claimed in claim 10, additionally comprising the stejps of: 
paging said mobile station over one of said control channels using said control 

channel protocol; 

instructing said mobile station to tune to said one voice channel; 
transmitting a digital synchronizing signal over said one voice chaimeU 
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tuning said mobile station to said one voice channel; 
synchronizing said mobile station to said synchronizing signal; and 
transmitting said MIN programming to said mobile station over said one voice 
channel using said control channel protocol. 

12. A method of operating a cellular telecommunications system to manage user-specific 
programming which is stored in a mobile station having an electronic serial number (ESN) 
stored therein which uniquely identifies said mobile station, said user-specific programming 
including a mobile identification numb^ (MIN), said MIN being a telephone number which 
is assigned to said mobile station so that said mobile station operates in an inactive state 
wherein said mobile station docs not have a valid MIN but has an ESN and in an active 
Slate wherein said mobile station has a valid MIN. said method comprising the steps of: 

communicating between said land station and said mobile station using a mode 
selected from a digital data mode and an analog audio mode; 

operating said land station in cooperation with said mobile station so that said 
selected digital data mode is used to communicate both signalling and said user-specific 
programming; 

operating said land station in cooperation with said mobile station so that said 
selected analog audio mode is used to communicate said us^ information; 

using said MIN to signal calls directed to said mobile station when said mobile station 
operates in said active state; and 

using said ESN to signal calls directed to said mobile station when said mobile station 
operates in said inactive state. 

13. A method of activating a cellular mobile station f^om a location which is remote to 
said mobile station, said method comprising the steps of: 

storing, in said mobile station, data describing a location-independent Identifying 
code for said mobile station; 

receiving page signalling messages at said mobile station; 

evaltiating said page signalling messages to detect a page which references said 

location-independent identifying code; and 
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engaging, in response to said page, in a renwte progranmiing session in which 
user-spwific programming is received at and stored in said mobile station. 

14. A method as claimed in claim 13, which coroprising providing. said location- 
independent identifying code as an electronic serial number (ESN), 

15. A method as claimed in claim 14, including: 

carrying out said engaging step to assign a mobile identrBcation number (MIN) to 
said mobile station, said MIN being a telephone number for said mobile station; 

operating said mobile station in an inactive state prior to activation and operating said 
mobile station in an active state after activation; and 

paging said mobile station using data which reference said MIN when said mobile 
station is operating in said active state. 

16. A method as claimed in claim 14 or claim 15, additionally comprising the step of: 
encrypting said ESN; and 

transmitting a page signalling message which conveys said ESN in an encrypted 

form. 

17. A method as claimed in my one of claims 13 to 16, including 
engaging said mobile station in signalling communications, user-specific 

programming communications » and user information communications, 

operating said mobile station in a digital data mode to communicate both said 

signalling communications and said user-specific programming communications; and 
operating said mobile station in an analog audio mode to communicate said user 

information. 



18. A method as claimed in claim 17, including: 
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operating said mobile station to cooperate widl a cellular system to exchange a first 
pordon of said signalling communications over control channels in said digital data mode 
using a control channel protocol, to exchange a second portion of said signalling 
communications over a voice channel in said digital data mode using a voice channel 
protocol, and to exchange said user information over said voice channels in said analog . 
audio mode; and 

transferring said user-specific programming to said mob'de station using said control 
channel protocol over one of said voice channels* 

19. A method as claimed in any one of claims 13 to 18, additionally comprising the steps 
of: 

paging said mobile station over one of said control channels using, said control 
channel protocol; 

instructing said mobile station to tune to said one voice channel; 

transmitting a digital synchronizing signal over said one voice channel; 

tuning said mobile station to said one voice channel; 

synchronizing said mobile station to said synchronizing signal; and 

transmitting said user-specific programming to said mobile station over said one 
voice channel using said control channel protocol. 

20. A cellular telephone whidi is configured for remote activation, said cellular telephone 
conq)rising: 

an amenna; 

a transmitter which is coupled to said antetma; 
a receiver which is coupled to said antenna; 

a controller which is coupled to said transmitter and to said receiver; and 

a memory which is coupled to said controller; 
wherein said controller is configured to detect a page message which is received over a 
cellular network, said page message referencing a location-independent identifying code 
stored in said memory. 
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21. A cellubt telephone which is configured fbr remote activation, said cellular telephone 
comprising: 

an antenna; 

a transmitter which is coupled to said antenna; 

a receiver which is coupled to said antenna, said receiver being configured to conduct 
telephone calls; 

a controller which is coupled to said transmitter and to said receiver; and 

a memory which is coupled to said controller; 
whereiu said controller is configured to detea a page message received at said receiver and 
referencing a location-independent identifying code stored in said memory. 

22. The cellular telephone of claim 20 or claim 21, wherein said location-independent 
identifying code is derived from an electronic serial number (ESN) assigned to said cellular 
telephone. 

23. The cellular telephone of claim 20, claim 21 or claim 22, wherein said controller is 
iurfher configured to enter a remote programming mode after detecting said page message. 

24. The cellular telephone of claim 23, wherein^ after entering said remote programming 
mode, said controller is configured to accept digital data received by said cellular telephone 
and to store said digital data in said memory. 

25. The ceUular telephone of claim 24, wherein said digital dau comprises a home 
system identification number (SID) for said cellular telephone. 

26. The cellular telephone of claim 24, wherein said digital data comprises a system 
identification nximber (SID). 

27. The ceUular telephone of claim 24, wherein said digital data comprises a mobile 
identification number (NUN) for said cellular telephone. 
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28. The cellular telephone of claim 24, wherein said digital data comprises an executahle 
instnictiou. 

29. A cellular telephone comprising: 
an antenna; 

a transmitter which is coupled to said antenna; 

a receiver which is coupled to said antenna, so that said antenna /said transmitt^, and 
said receiver form an air interface for said cellular telephone; 

a controller which is coupled to said air interface; and 

a memory which is coupled to said controller; 
wherein said controller is configured to detect a page message which is received from a 
cellular network by said air interface, said page message referencing a location-independent 
identifying code stored in said memory. 

30. A cellular telephone comprising: 
an antenna; 

a transmitter which is con:GgurGd to conduct telephone calls > said transmitter being 
coupled to said antenna; 

a receiver which is configured to conduct telephone calls, said receiver being coupled 
to said antenna and to said antenna, said transmitter and said receiver forming an air 
mterface for said cellular telephone; 

a controller which is coupled to said air interface; and 

a memory which is coupled to said controller; 
wherein said controller is configured to detect a page message received through said 
receiver by said air interface, said page message referencing a location-independent 
identifying code stored in said memory. 

31. The cellular telephone of claim 29 or claim 30, wherein said location-independent 
identifying code is derived from an electronic serial number (ESN) of said cellular 
tel^hone. 
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32. The cellular telephone of claim 31, wherein after detecting said page message^ said 
controller is further configured to receive remote programming informatian received by 
said air interface. 

33. The cellular telq>hane of claim 32, wherein said remote programming information 
comprises a mobile identification number (MIN)- 

34. The cellular telephone of claim 33, wherein said controller is configured to store said 
received mobile identification number (MIN) in said memory, 

35. A cellular telephone which is configured for network initiated activation, said cellular 
telephone comprising: 

an antenna; 

a transmitter which is coupled to said antenna; 
a receiver which is coupled to said antenna; 

a controller which is coupled to said transmitter and to said receiver; and 

a memory which is coupled to said controller, said memory containing an electronic 

serial number (ESN) assigned to said cellular telq)hone but not containing a mobile 

identification number (MIN) assigned to said cellular telephone; 

wherein said controller is configured to detect a page message that references data derived 
from said electronic serial number CESN) and to enter a remote programming mode after 
detecting said page message, 

36. The cellular telephone of claim 35, wherein said controller is configured to accept 
digital data which is received by said cellular telephone while said controller is in said 
remote programming mode. 

37. A cellular telephone configured for network initiated acrivation, said cellular 
telephone comprising: 

an antezma; 

a transmitter which is coupled to said antenna; 
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a receiver wbich is coiipled to said antenna; 
a memory containing a locationrindependent identifying code; and 
first means for detecting a page message which references said location-independent 
identifying code. 

38. The cellular telephone of claim 37, further comprising: 

second means for entering a remote programming mode after said first means has 
detected said page message. 

39. The cellalar telq)hone of claim 38, wherein said celhilar telephone is configured to 
receive digital data while in said remote programming mode and to store said digital data in 
said memory. 

40. The cellular telephone of any one of claims 35 to 39, wherein said digital data 
, comprises a mobile identification number (MIN). 

41 . The cellular telephone of any one of claims 35 to 39 , wherein said digital data 
comprises a system identification number (SID). 

42. The cellular telephone of any one of claims 35 to 39, wherein said digital data 
comprises an executable instruction. 

43. A cellular telephone which is configured fior remote reprogramming^ said cellular 
telephone comprising: 

an antenna; 

a receiver which is coupled to said antenna; 
a transmitter which is coupled to .said antenna; 

a controller which is coupled to said transmitter and to said receiver; and 

a memory which is coupled to said controller, said memory containing an electronic 

serial number (ESN) and a first valid mobile identification number (MIN) for said cellular 

telephone; 
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wherein said controUer is configured to accept digital data which is received over a celhilar 
network by said receiver operating in a digital data mode and to store said digital data in 
said memory. 

44. A cellular telephone which is configured for network inidaied remote programming, 
said cellular telephone comprising: 
an antenna; 

a transmitter which is coupled to said antenna; 

a receiver which is coupled to said antenna, said receiver being configured to condua 
telephone calls; 

a controller which is coupled to said transmitter and to said receiver; and 

a memory which is coupled to said controller; 
wherein said controller is configured to detect a digital message which is received by said 
receiver and to enter a remote programming mode after detecting said digital message. 

45. A cellular telephone which is configured for network initiated remote programming, 
said cellular telephone comprising: 
an antenna; 

a transmitter which is coupled to said antenna; 
a receiver which is coupled to said antenna; 

a memory containing an electronic serial number (ESN) and a first mobile 

identification number (MIN); 

first means for detecting a digital message received by said receiver; and 
second means for entering a remote programming mode wherein said cellular 

telephone receives digital data which is formatted according to a control channel protocoK 

said second means entering said remote progrannnmg mode after said first means detects 

said digital message. 

4<5. The cellular telephone of cl£um 43 or claim 44, wherein said receiver is configured 
to receive said digital data which is formatted according to a control channel protocol. 
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47. The ccUxilar telephone of daizn 46, wherein said digital data comprises a second 
mobUe identification number (MIN), said second MIN being different than said first MIN. 

48. The cellular telephone of claim 46. wherein said digital data comprises a second 
mobile identification number (MIN). 

49. The cellular telephone of claim 46, wherein said digital data comprises a system 
identification number (SBD), 

50. The cellular telephone of claim 46, wherem said digital programming data comprises 
a mobile identification number (MIN). 

51. The cclhilar telephone of claun 46, wherein said digital programming data comprises 
an executable instruction. 

52. The cellular telephone of clahn 46^ wherein said digital data comprises data that 
deactivates said cellular telephone. 

53. The cellular telephone of clann 46, wherein said digital data comprises a deactivation 
conmiand. 

54. The cellular telephone of claim 46, wherein said digital data is conveyed to said 
cellular telephone through a remote programming session initiated by said cellular network, 

55. The cellular tel^hone of any one of claims 45 to 54. wherem said controller is 
further configured to accqrt digital programming data which is received by said receiver 
while said' receiver is in said remote programming mode at)d to store said digital 
programming data in said memCHry. 

56. The cellular telephone of any one of clahns 45 to 55, wherein said digital message is 
initiated by said network. 
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57. A ceUular telephone >vhich is configured for remote activation, the cellular telephone 

comprising: 

an antenna; 

a transmitter which is co\ipled to antenna; 
a receiver whidi is coupled to s^d antenna; 

a controller which is coupled to said transmitter and to said receiver; and 
a memory which is coupled to said controUer; wherein said controller is configured 
to detect a page message that references a location-independent identifying code stored in 
said memory, and wherein said locarion-independent identifying code is derivrf from an 
electronic serial number (ESN) which is assigned to said cellular telephone. . 

58. The cellular telephone of claim 57, wherein said controller is further configured to 
enter a remote programming mode after detecting said page message, 

59. The cellular telephone of claim 58, wherein, after entering said remote programming 
mode, said controller is configured to accept digital data which is received by said cellular 
telephone and to store s^d digital data in said memory. 

60. The cellular telephone of claim 59, wherein said digital data comprises a home 
system identification number (SID) for said cellular telephone, 

61. The ceUular telephone of claim 59, wherein said digital data comprises a system 
identification number (SID). 

62. The ceUular telephone of claim 59, wherein said distal data comprises a mobile 
identification number (MIN) for said cellular telephone^ 

63. The cellular telephone of claim 59, wherein said digital data comprises an executable 
instruction. 



PAGE 53/65 ^ RCVD AT 1 (W/2005 7:20:07 PM [Eastern toylight r^^^ 



10/07/05 16:37 FAX 503 228 9446 KLARQUIST PATENT 121054 



43 

64. A cellular telephone comprising: 
an antenna; 

a transimtter which is coupled to said antenna; 

a receiver which is coupled to said antenna so that said antenna, said transmitter, and 
said receiver form an air interface for said cellular telephone; 
a controller which is coupled to said air interface; and 
a memory which is coupled to said controller; 

wherein said controUer is configured to detect a page message which is received by 
said air interface, said page message refierencing a location-independent identifying code 
which is stored in said memory, and 

wherein said location-independent identifying code is derived from an electronic 
serial number (ESN) of said cellular telephone. 

65. The cellular telephone of claim 64. wherein after detecting said page message, said 
controller is further configured to receive remote programming information received by 
said air Interface. 

66. The cellular telephone of claim 64, wherein said remote programming information 
comprises a mobile identificadon number (NUN). 

67- The cellular telephone of claim 65, wherein said controller is configured to store said 
received mobile identification number (MIN) in said memory. 

68 . A remotely programmable cellular radiotelephone device comprising: 
a first memory location for storing a unique telephone serial number; 
a second memory location which is programmed with an initial identification number 

wherein said initial identification number is associated with said telephone serial number; 
transceiver means for transmitting and receivmg cellular radiotelephone 

communication signals to and from a cellular system; and 
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prograirnning means for reprogramming said second memory location in response to 
receipt of a mobile identification nmnber from said transceiver means so that said second 
memory location is programmed with said mobile identification number. 

69 . A remotely programmable cellular radiotelephone device comprising: 

a non-programmable memory for storing a unique telephone serial number; 

a programmable memory which is programmed with an initial identification number, 

wherein said initial identification number comprises digits from said telephone serial 

number; 

transceiver means for transmitting and receiving cellular radiotelephone 
communication signals to and from a cellular system; and 

programming means for reprogramming said programmable memory in response to 
receipt of a mobile identification number firom said transceiver means so thai said 
programmable memory location is programmed with said mobile identification number, 

70. A remotely programmable cellular radiotelephone device accordfaig to claim 68 or 
claim 69, wherein said unique telephone serial number is an electronic serial number (ESN) 
of said cellular radiotelephone servitt. 

71 . A remotely programmable cellular radiotelephone device according to claim 68> 
claim 69 or claim 70, wherein said transceiver means comprises pag« receiving means for 
receiving a data communication message from said cellular system; 

wherein said radiotelephone device is identified by said initial identification number; 

and 

wherein said data communication message comprises said mobile identification 
number. 

72. A wireless tel^hone which is configured for activation through an activation call 
originated from a location remote to said wireless telephone, said wireless telephone 
comprising: 

an antenna; 
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a iransmitter which is coupled to said anteona, said transmitter being configured to 
conduct user information calls; 

a receiver which is coupled to said antenna, said receiver being configured to conduct 
said activation call and said user information calls; 

a controller, which is coupled to said transmitter and to said receiver; and 

a memory which is coupled to said controller; 

wherein said controller is configured to detect a page message received at said 
receiver during origination of said activation call and referencing a location-independent 
identifying code stored in said memory. 

73 . A method for remotely programming a cellular radiotelephone device which includes 
a programmable memory, said cellular radiotelephone device being progranuned with a 
unique initial identification number, said remotely programming method comprising the 
steps of: 

providing said unique initial identification number to a cellular system; 

establishing a data communication session from said cellular system to said cellular 
radiotelephone device using said unique initial identification number to identify said 
cellular radiotel^hone device; 

transmitting data to said cellular radiotelephone device during said session, wherem 
said data comprises a mobile identification cumber; and 

reprogramming said cellular radiotelephone device so that said cellular radiotelephone 
device is programmed with said mobile identification number. 

74. A method according to claun 73, which includes providing said cellular 
radiotelephone device with a first memory location for storing a unique telephone serial 
number, wherein said initial identification number is associated with said telephone 
nuinber. 

75. A method for remotely programming a cellular radiotelephone device which includes 
a programmable memory which is programmed with a unique initial ideniiFication number, 
said remotely programming i^thod conqnising the steps of: 
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providing said unique initial identification raimber to a cellular system; 

establishing a data communication session from said cellular system to said cellular 
radiotelephone device using said unique initial identificaiion number to identify said 
cellular radiotelephone; 

transmitting data to said cellular radiotelephone device during said session, whereto 
said data comprises a mobile identification number; and 

reprogrannning said programmable memory so that said programmable memory is 
programmed with said mobile identification number. 

76. A method according to claim 75, including the step of providing said radiotelephone 
device with a non-programmable memory for storing a unique telephone serial number, 
wherein said initial identification number comprises digits from said telephonfi number. 

77. A method according to any one of claims 73 to 76, which comprises providing said 
telephone serial number in the form of an elecuonic serial number of said radiotelephone 
device. 

78. A method according to ai^ one of clafans 73 to 76, wherein said providing step 
further comprises the step of providing said telephone serial number to said cellular 
system; and wherein said providing step is followed by the step of comparing said 
telephone serial number and said initial identification number. 

79. A method according to any one of claims 73 to 76, wherein said providing step 
further comprises providing data other than said unique initial identification numha- to said 
cellnlar system. 

80. A method according to claim 79» wherein said providing step is followed by the step 
of controlling the activation of said radiotelephone device. 
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